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Abstract — We propose a secure scheme for wireless network 
coding, called the algebraic watchdog. By enabling nodes to detect 
malicious behaviors probabilistically and use overheard messages 
to police their downstream neighbors locally, the algebraic 
watchdog delivers a secure global self-checking network. Unlike 
traditional Byzantine detection protocols which are receiver- 
based, this protocol gives the senders an active role in checking 
the node downstream. The key idea is inspired by Marti et al. 's 
watchdog-pathrater, which attempts to detect and mitigate the 
effects of routing misbehavior. 

As an initial building block of a such system, we first focus on 
a two-hop network. We present a graphical model to understand 
the inference process nodes execute to police their downstream 
neighbors; as well as to compute, analyze, and approximate the 
probabilities of misdetection and false detection. In addition, 
we present an algebraic analysis of the performance using an 
hypothesis testing framework that provides exact formulae for 
probabilities of false detection and misdetection. 

We then extend the algebraic watchdog to a more general 
network setting, and propose a protocol in which we can establish 
trust in coded systems in a distributed manner. We develop a 
graphical model to detect the presence of an adversarial node 
downstream within a general multi-hop network. The structure 
of the graphical model (a trellis) lends itself to well-known 
algorithms, such as the Viterbi algorithm, which can compute 
the probabilities of misdetection and false detection. We show 
analytically that as long as the min-cut is not dominated by the 
Byzantine adversaries, upstream nodes can monitor downstream 
neighbors and allow reliable communication with certain prob- 
ability. Finally, we present simulation results that support our 
analysis. 



I. Introduction 

There have been numerous contributions to secure wireless 
networks, including key management, secure routing, Byzan- 
tine detection, and various protocol designs (for a general 
survey on this topic, see Q EHUD SB CHI)- Countering 
these types of threats is particularly important in military 
communications and networking, which are highly dynamic 
in nature and must not fail when adversaries succeed in 
compromising some of the nodes in the network. We consider 
the problem of Byzantine detection. The traditional approach is 
receiver-based - i.e. the receiver of the corrupted data detects 
the presence of an upstream adversary. However, this detection 
may come too late as the adversary is partially successful in 
disrupting the network (even if it is detected). It has wasted 
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network bandwidth, while the source is still unaware of the 
need for retransmission. 

Reference [9| introduces a protocol for routing wireless net- 
works, called the watchdog and pathrater, in which upstream 
nodes police their downstream neighbors using promiscuous 
monitoring. Promiscuous monitoring means that if a node v 
is within range of a node v' , it can overhear communication 
to and from v' even if those communication do not directly 
involve v. This scheme successfully detects adversaries and 
removes misbehaving nodes from the network by dynamically 
adjusting the routing paths. However, the protocol requires a 
significant overhead (12% to 24%) owing to increased control 
traffic and numerous cryptographic messages (9j- 

Our goal is to design and analyze a watchdog-inspired 
protocol for wireless networks using network coding. We 
propose a new scheme called the algebraic watchdog, in 
which nodes can detect malicious behaviors probabilistically 
by taking advantage of the broadcast nature of the wireless 
medium. Although we focus on detecting malicious or mis- 
behaving nodes, the same approach can be applied to faulty 
or failing nodes. Our ultimate goal is a robust self-checking 
network. The key difference between the our work iflOl and 
that of (9) is that we allow network coding. Network coding 
|[TTllfT2l is advantageous as it not only increases throughput 
and robustness against failures and erasures but also it is 
resilient in dynamic/unstable networks where state information 
may change rapidly or may be hard to obtain. 

The key challenge in algebraic watchdog is that, by incor- 
porating network coding, we can no longer recognize packets 
individually. In (9), a node v can monitor its downstream 
neighbor v' by checking that the packet transmitted by v 1 is 
a copy of what v transmitted to v' . However, with network 
coding, this is no longer possible as transmitted packets are a 
function of the received packets. Furthermore, v may not have 
full information regarding the packets received at v'; thus, 
node v is faced with the challenge of inferring the packets 
received at v' and ensuring that v' is transmitting a valid 
function of the received packets. We note that [13 1 combines 
source coding with watchdog; thus, fl"3l does not face the 
same problem as the algebraic watchdog. 

The paper is organized as follows. In Section UU we briefly 
discuss the intuition behind algebraic watchdog. In Section HTT1 
we present the background and related material. In Section 
IIVI we introduce our problem statement and network model. 
In Section [V] we analyze the protocol for a simple two-hop 
network, first algebraically in Section lV-Bl and then graphically 
in Section IV-AI In Section [VlJ we extend the analysis for 
algebraic watchdog to a more general two-hop network, and 
in Section rVIIII we present an algebraic watchdog protocol for 
a multi-hop network. We present simulation results in Section 
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Fig. 1: An example network. 



11X1 which confirm our analysis and show that an adversary 
within the network can be detected probabilistically by up- 
stream nodes. In Section [X] we summarize our contribution 
and discuss some future work. 

II. Intuition 

Consider a network in which the sources are well-behaving 
(If the sources are malicious, there is no "uncorrupted" in- 
formation flow to protect). In such a case, the sources can 
monitor their downstream neighbors as shown in Figure Q] 
Assume that nodes i>i, i>2> «3j and V4 are sources. Nodes in 
So = {vi,V2,Vs} can monitor v 5 collectively or indepen- 
dently. In addition, u 3 and v 4 can monitor v e . This enforces 
v$ and v 6 to send valid information. Note that we do not make 
any assumption on whether V5 and vq are malicious or not - 
they are forced to send valid information regardless of their 
true nature. 

If it is the case that W5 and v$ are well-behaving, then we can 
employ the same scheme at v$ or vq to check vr's behavior. 
Thus, propagating trust within the network. Now, what if V5 
or vq are malicious? If both V5 and vq are malicious, all flows 
to iv are controlled by malicious nodes - i.e. flows through 
v? are completely compromised. Therefore, even if v-j is well- 
behaving, there is nothing that v-j or vi, V2, V3, V4 can do to 
protect the flow through v-j. The only solution in this case 
would be to physically remove V5 and vq from the network or 
to construct a new path to vj. 

The intuition is that as long as the min-cut to any node is 
not dominated by malicious nodes, then the remaining well- 
behaving nodes can check its neighborhood and enforce that 
the information flow is delivered correctly to the destination. 
For example, assume that only v& is malicious and V5 is well- 
behaving in Figure Q] Since W3 and V4 monitor v§, we know 
that despite vq being malicious, vq is forced to send valid 
information. Then, vj receives two valid information flows, 
which it is now responsible of forwarding. If W7 is well- 
behaving, we do not have any problem. If v-j is malicious, 
it may wish to inject errors to the information flow. In this 
case, V*; is only liable to V5; but it is liable to at least one 
well -behaving node V5. Thus, it is not completely free to inject 
any error it chooses; it has to ensure that 775 cannot detect its 
misbehavior, which may be difficult to accomplish. 

In this paper, we show that this is indeed the case. We 
first start by studying a two-hop network, which would be 
equivalent to focusing on the operations performed by nodes 
in So to check v 5 . Then, we discuss how we can propagate 
this two-hop policing strategy to a multi-hop scenario. 



III. Background 

A. Secure Network Coding 

Network coding, first introduced in lUTI . allows algebraic 
mixing of information in the intermediate nodes. This mixing 
has been shown to have numerous performance benefits. It is 
known that network coding maximizes throughput for mul- 
ticast [11| and increases robustness against failures ITZl and 
erasures fl4l . However, a major concern for network coded 
systems is their vulnerability to Byzantine adversaries. A sin- 
gle corrupted packet generated by a Byzantine adversary can 
contaminate all the information to a destination, and propagate 
to other destinations quickly. For example, in random linear 
network coding 0141 . one corrupted packet in a generation (i.e. 
a fixed set of packets) can prevent a receiver from decoding 
any data from that generation even if all the other packets it 
has received are valid. 

There are several papers that attempt to address this prob- 
lem. One approach is to correct the errors injected by the 
Byzantine adversaries using network error correction |fT31 . 
Reference |fT31 bounds the maximum achievable rate in an 
adversarial setting, and generalizes the Hamming, Gilbert- 
Varshamov, and Singleton bounds. Jaggi et al. fT6l propose a 
distributed, rate-optimal, network coding scheme for multicast 
network that is resilient in the presence of Byzantine adver- 
saries for sufficiently large field and packet size. Reference 
ffTTl generalizes |[T6l to provide correction guarantees against 
adversarial errors for any given field and packet size. In 
|[l"8l . Kim et al. compare the cost and benefit associated with 
these Byzantine detection schemes in terms of transmitted bits 
by allowing nodes to employ the detection schemes to drop 
polluted data. 

B. Secure Routing Protocol: Watchdog and Pathrater 

The problem of securing networks in the presence of Byzan- 
tine adversaries has been studied extensively, e.g. (6) Q (8) . 
The watchdog and pathrater J9] are two extensions to the 
Dynamic Source Routing lfl9l protocol that attempt to detect 
and mitigate the effects of routing misbehavior. The watchdog 
detects misbehavior based on promiscuous monitoring of the 
transmissions of the downstream node to confirm if this relay 
correctly forwards the packets it receives. If a node bound 
to forward a packet fails to do so after a certain period of 
time, the watchdog increments a failure rating for that node 
and a node is deemed to be misbehaving when this failure 
rating exceeds a certain threshold. The pathrater then uses the 
gathered information to determine the best possible routes by 
avoiding misbehaving nodes. This mechanism, which does not 
punish these nodes (it actually relieves them from forwarding 
operations), provides an increase in the throughput of networks 
with misbehaving nodes (9). 

C. Hypothesis Testing 

Hypothesis testing is a method of deciding which of the two 
hypotheses, denoted Hq and Hi, is true, given an observation 
denoted as U. In this paper, Hq is the hypothesis that v is well- 
behaving, Hi is that v is malicious, and U is the information 
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gathered from overhearing. The observation U is distributed 
differently depending whether Ho or Hi is true, and these 
distributions are denoted as Pu\h an d Pu\H t respectively. 

An algorithm is used to choose between the hypotheses 
given the observation U. There are two types of error associ- 
ated with the decision process: 

• Type 1 error, False detection: Accepting H\ when Ho is 
true {i.e. considering a well-behaving v to be malicious), 
and the probability of this event is denoted 7. 

• Type 2 error, Misdetection: Accepting Hq when Hi is 
true (i.e. considering a malicious v to be well-behaving), 
and the probability of this event is denoted f3. 

The Neyman-Pearson theorem gives the optimal decision rule 
that given the maximal tolerable /?, we can minimize 7 by 
accepting hypothesis Hq if and only if log p u ^° > t for 
some threshold t dependant on 7. For more thorough survey 
on hypothesis testing in the context of authentication, see l20l . 

IV. Problem Statement 

We shall use elements from a field, and their bit- 
representation. We use the same character in italic font (i.e. 
x) for the field element, and in bold font (i.e. x) for the 
bit-representation. We use underscore bold font (i.e. x) for 
vectors. For arithmetic operations in the field, we shall use 
the conventional notation (i.e. +,—,•)• For bit-operation, we 
shall use © for addition, and ® for multiplication. 

We also require polynomial hash functions defined as fol- 
lows (for a more detailed discussion on this topic, see ED)- 

Definition 4.1 (Polynomial hash functions): For a finite 
field F and d > 1, the class of polynomial hash functions 
on F is defined as follows: 

H d (F) = {h a \a = (ao, ...,a d ) £ F d+1 }, 

where h a (x) = 2~2i=o aiX% ^ or x ^ ^. 

We model a wireless network with a hypergraph G = 
(V, Ei, E2), where V is the set of the nodes in the network, 
Ei is the set of hyperedges representing the connectivity 
(wireless links), and E2 is the set of hyperedges represent- 
ing the interference. We use the hypergraph to capture the 
broadcast nature of the wireless medium. If (ui,^) £ E\ 
and (wi,«3) <G E 2 where Vi,v 2 ,v 3 £ V, then there is an 
intended transmission from vi to v 2 , and w 3 can overhear 
this transmission (possibly incorrectly). There is a certain 
transition probability associated with the interference channels 
known to the nodes, and we model them with binary channels, 
BSC{ Pt] ) for {vi,Vj)£E 2 . 

A node Vi £ V transmits coded information x% by trans- 
mitting a packet pi, where p, = [a{, hi i; h Xi ,Xi] is a {0, 1}- 
vector. A valid packet pi is defined as below: 

> ai corresponds to the coding coefficients atj, j £ 
where I; C V is the set of nodes adjacent to Vi in E±, 

• hi. corresponds to the hash h(xj), Vj £ Ii where h(-) is 
a 5-bit polynomial hash function, 

• h x . corresponds to the polynomial hash h(xj), 

• Xj is the n-bit representation of Xi = 2~2jei a j x j £ 
(BV). 
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Fig. 2: A valid packet pi sent by well-behaving Wj. 

Figure|2]illustrates the structure of a valid packet. For simplic- 
ity, we assume the payload Xi to be a single symbol. We design 
and analyze our protocol for a single symbol. However, the 
protocol applies (and therefore, the analysis) to packets with 
multiple symbols by applying the protocol on each symbol 
separately. 

The payload Xj is coded with a (n, fci)-code Ci with 
minimum distance d{. Code C; is an error-correcting code of 
rate Ri = — = 1 — — , and is tailored for the forward commu- 
nication. For instance, Vi uses code C\, chosen appropriately 
for the channel (vi,Vj) £ Ei, to transmit the payload Xi. 

We assume that the payload Xi is n-bits, and the hash h(-) is 
(5-bits. We assume that the hash function used, h(-), is known 
to all nodes, including the adversary. In addition, we assume 
that ai, hi. and h x . are part of the header information, and are 
sufficiently coded to allow the nodes to correctly receive them 
even under noisy channel conditions. Protecting the header 
sufficiently will induce some overhead, but the assumption 
remains a reasonable one to make. First, the header is smaller 
than the message itself. Second, even in the routing case, the 
header and the state information need to be coded sufficiently. 
Third, the hashes hi. and h x . are contained within one hop. 
A node that receives pi = [ai, hi i5 h Xi , Xi] does not need to 
repeat hi i; only h Xi . Therefore, the overhead associated with 
the hashes is proportional to the in-degree of a node, and does 
not accumulate with the routing path length. 

Assume that Vi transmits p ; = [ai, hij, h Xi , Xj], where Xi = 
Xi © e, e £ {0, 1}™. If Vi is misbehaving, then e / 0. Our 
goal is to detect with high probability when e ^ 0. Even if 
e| is small (i.e. the hamming distance between Xi and Xi is 
small), the algebraic interpretation of Xi and Xi may differ 
significantly. For example, consider n = 4, Xi = [0000], and 
x ; = [1000]. Then, e = [1000] and |e| = 1. However, the 
algebraic interpretations of Xi and Xi are and 8, respectively. 
Thus, even a single bit flip can alter the message significantly. 

A. Threat Model 

We assume powerful adversaries, who can eavesdrop their 
neighbor's transmissions, has the power to inject or corrupt 
packets, and are computationally unbounded. Thus, the adver- 
sary will find Xi that will allow its misbehavior to be unde- 
tected, if there is any such x^ However, the adversary does not 
know the specific realization of the random errors introduced 
by the channels. We denote the rate at which an adversary 
injects error (i.e. performs bit flips to the payload) to be p a dv- 
The adversaries' objective is to corrupt the information flow 
without being detected by other nodes. 

Our goal is to detect probabilistically a malicious behavior 
that is beyond the channel noise, represented by BSC( P ik). 
Note that the algebraic watchdog does not completely elim- 
inate errors introduced by the adversaries; its objective is to 
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Fig. 3: A small neighborhood of a wireless network with v\. 
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Fig. 4: A wireless network with m = 2. 

limit the errors introduced by the adversaries to be at most 
that of the channel. Channel errors (or those introduced by 
adversaries below the channel noise level) can be corrected 
using appropriate error correction schemes, which will be 
necessary even without Byzantine adversaries in the network. 

The notion that adversarial errors should sometimes be 
treated as channel noise has been introduced previously in 
lfl8l . Under heavy attack, attacks should be treated with special 
attention; while under light attack, the attacks can be treated 
as noise and corrected using error-correction schemes. The 
results in this paper partially reiterate this idea. 

V. Two-hop network: An Example 

Consider a network (or a small neighborhood of nodes in a 
larger network) with nodes V\,V2, ■■■v m , v m+ i, v m+ 2- Nodes 
Vi, i € [1|TO], want to transmit xi to v m +2 via v m+ i. A 
single node Vi, i £ [l,m], cannot check whether v m +i is 
misbehaving or not even if Vi overhears x m+ i, since without 
any information about Xj for j e [l,J7i], x m+ i is completely 
random to i>j. On the other hand, if Vi knows x m +i and xj 
for all j G [1,572,], then Vi can verify that v m +i is behaving 
with certainty; however, this requires at least to — 1 additional 
reliable transmissions to Wj. 

We take advantage of the wireless setting, in which nodes 
can overhear their neighbors' transmissions. In Figure [3] we 
use the solid lines to represent the intended channels E\, and 
dotted lines for the interference channels which we model 
with binary channels as mentioned in Section [IV] Each node 
checks whether its neighbors are transmitting values that are 
consistent with the gathered information. If a node detects that 
its neighbor is misbehaving, then it can alert other nodes in 
the network and isolate the misbehaving node. 

In the next subsections, we shall use an example with m = 
2, as shown Figure |4] We introduce the graphical model which 
explains how a node Vi checks its neighbor's behavior. Then, 
we use an algebraic approach to analyze and compute 7 and 
(5 for this example network with m = 2. In this section, we 
assume for simplicity that nodes do not code the payload - 
i.e. an error-correcting code of rate Ri = 1 is used. 
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Fig. 5: A graphical model from v\'s perspective 



Note that a malicious V3 would not inject errors in h X3 only, 
because the destination 1)4 can easily verify if h X3 is equal 
to h{xs). Therefore, h X3 and X3 are consistent. In addition, 
V3 would not inject errors in h Xj , j 6 ^3, as each node Vj 
can verify the hash of its message. On the other hand, a 
malicious v% can inject errors in a3, forcing V4 to receive 
incorrect coefficients a/s instead of ay's. However, any error 
introduced in a.3 can be translated to errors in X3 by assuming 
that ay's are the correct coding coefficients. Therefore, we are 
concerned only with the case in which V3 introduces errors in 
X3 (and therefore, in h X3 such that h X3 = h(xs))- 

A. Graphical model approach 

We present a graphical approach to model the problem for 
m = 2 systematically, and to explain how a node may check 
its neighbors. This approach may be advantageous as it lends 
easily to already existing graphical model algorithms as well 
as some approximation algorithms. 

We shall consider the problem from Ui's perspective. As 
shown in Figure [6] the graphical model has four layers: 
Layer 1 contains 2 n+h vertices, each representing a bit- 
representation of [x2,h(x2)]; Layer 2 contains 2™ vertices, 
each representing a bit-representation of X2; Layer 3 contains 
2" vertices corresponding to X3; and Layer 4 contains 2 n+h 
vertices corresponding to [X3, h(xa)]. Edges exist between 
adjacent layers as follows: 

• Layer 1 to Layer 2: An edge exists between a vertex 
[v, u] in Layer 1 and a vertex w in Layer 2 if and only if 
h(w) = u. The edge weight is normalized such that the 
total weight of edges leaving [v, u] is 1, and the weight 
is proportional to: 

P(v| Channel statistics and w is the original message), 

which is the probability that the inference channel outputs 
message v given an input message w. 

• Layer 2 to Layer 3: The edges represent a permutation. 
A vertex v in Layer 2 is adjacent to a vertex w in Layer 
3 if and only if w = c + ct2V, where c = a\X\ is a 
constant, v and w are the bit-representation of v and w, 
respectively. The edge weights are all 1. 

• Layer 3 to Layer 4: An edge exists between a vertex v 
in Layer 3 and a vertex [w, u] in Layer 4 if and only if 
h(v) = u. The edge weight is normalized such that the 
total weight leaving v is 1, and is proportional to: 

P(w| Channel statistics and v is the original message). 

Node vi overhears the transmissions from V2 to V3 and from 
V3 to Vi', therefore, it receives [x2,h(x2)] and [x3,h(xa)], 
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corresponding to the starting point in Layer 1 and the desti- 
nation point in Layer 4 respectively. By computing the sum 
of the product of the weights of all possible paths between the 
starting and the destination points, Vi computes the probability 
that i>3 is consistent with the information gathered. 

This graphical model illustrates sequentially and visually 
the inference process Vi executes. Furthermore, by using 
approximation algorithms and pruning algorithms, we may be 
able to simplify the computation as well as the structure of 
the graph. In addition, the graphical approach may be extend 
to larger networks, as we shall discuss in Section [VTl 

B. Algebraic approach 

We explain the inference process described above using the 
graphical model introduced in Section [V-AI Consider v\. By 
assumption, v\ correctly receives &3, hi 2 , hi 3 , h X2 , and 
h X3 . In addition, v% receives X2 = ^-2 + e' and £3 = X3 + e", 
where e' and e" are outcomes of the interference channels. 
Given xj for j = {2,3} and the transition probabilities, v\ 
computes Tj^\ such that the sum of the probability that the 
interference channel from Vj and v\ outputs xj given x G 
-B(xj, Tj^i) is greater or equal to 1 — e where e is a constant, 
and B(x, r) is a n-dimensional ball of radius r centered at x. 
Now, t>i computes Xj = {x | h(x) = h(xj)} n -B(xj, r^i) 
for j = {2, 3}. Then, v\ computes ct\X\ + a 2 i for all x G X 2 . 
Then, v\ intersects X3 and the computed aiX\ + a 2 i's. If the 
intersection is empty, then v\ claims that R is misbehaving. 

The set {x | h(x) = /i(x 2 )} represents the Layer 2 vertices 
reachable from the starting point ([x2,h(x2)] in Layer 1), 
and X2 is a subset of the reachable Layer 2 vertices such 
that the total edge weight (which corresponds to the transition 
probability) from the starting point is greater than 1 — e. 
Then, computing aixi -\-a2x represents the permutation from 
Layers 2 to 3. Finally, the intersection with X3 represents 
finding a set of Layer 3 vertices such that they are adjacent to 
the destination point ([x3,h(xs)] in Layer 4) and their total 
transition probability to the destination point is greater than 
1 - e. 

Lemma 5.1: For n sufficiently large, the probability of false 
detection, 7 < e for any arbitrary small constant e. 

Proof: Assume that V3 is not malicious, and transmits X3 
and h X3 consistent with v^s check. Then, for n sufficiently 
large, v\ can choose r 2 ^i and such that the probability 
that the bit representation of X3 = ct\X\ + 0,2X2 is in X3 and 
the probability that X2 G X2 are greater than 1 — e. Therefore, 
X3 n {a±xi + a.2X j Vx G X2} 7^ with probability arbitrary 
close to 1. Therefore, a well-behaving V3 passes vi's check 
with probability at least 1 — e. Thus, 7 < e. ■ 

Lemma 5.2: The probability that a malicious V3 is unde- 
tected from vi's perspective is given by 



Er 3 -»i 
k=0 



2 h 



Proof: Assume that v 3 is malicious and injects errors 
into x 3 . Consider an element z <E X3, where z = aiXi + 
CX2X2 + e = aiXi +a 2 (x2 + e 2 ) for some e and e 2 . Note that, 
since we are using a field of size 2", multiplying an element 



from the field by a randomly chosen constant has the effect 
of randomizing the product. Here, we consider two cases: 

Case 1: If X2 + &2 £ X2, then V3 fails ui's check. 

Case 2: If X2+&2 & X2, then V3 passes ui's check; however, 
V3 is unlikely to pass V2 7 s check. This is because ol\X\ + 
a 2 (x2 +e 2 ) = aix% +a 2 x 2 +a 2 e 2 = ai(xi +ei) + a 2 x 2 for 
some e\. Here, for uniformly random ct\ and a 2 , ei is also 
uniformly random. Therefore, the probability that V3 will pass 
is the probability that the uniformly random vector x\ + e\ 
belongs to X\ = {x \ h(x) = /i(a;i)}ni?(xi,ri^ 2 ) where w 2 
overhears xi from v\, and the probability that the interference 
channel from V\ to v 2 outputs xx given x G B(Si 1 , r 1 _ J>2 ) is 
greater than 1 — e. 

P(A malicious V3 passes w 2 's check) 

Vol{Xi) 



ei G Xi = 



2" 



where Vol(-) is equal to the number of {0, l}-vectors in the 
given set. Since Vol{B(x,r)) = ^=o (fc) ^ 2 "' and ths 
probability that h(x) is equal to a given value is ■ 2 \, Vol(Xi) 
is given as follows: 



VoliXi) = 



Therefore, from «i's perspective, the probability that a z G X3 
passes the checks, P(z passes check), is: 



• P(a; 2 + e 2 i X 2 ) 



k=0 \k) 
2(h+n) 



P(x 2 +e 2 G X 2 ). 



Similarly, P{x 2 + e 2 G X 2 ) = ^jffeP, and Vol(X 3 ) = 

— k ~° h ykJ . Then, the probability that V3 is undetected from 
Vi's perspective is the probability that at least one z G X3 
passes the check: 

P(A malicious V3 is undetected from vi's perspective) 
= min{l, P(z passes check) • Vol(X3)}. 

Note that P(z passes check) • ^0/(^3) is the expected num- 
ber of z G X3 that passes the check; thus, given a high 
enough P(z passes check), would exceed 1. Therefore, we 
take min{l, P(z passes check) ■ Vol(X3)} to get a valid 
probability. This proves the statement. ■ 
Lemma 5.3: The probability that a malicious V3 is unde- 
tected from i> 2 's perspective is given by 

k=0 \k) . 2^k=0 \k) _ l^k=a \k) 
' 2(h+n) 2(' l +") 2 h 

where ?; 2 overhears X3 from V3, and the probability that 
the interference channel from V3 to w 2 outputs X3 given 
x G B(x3,r3_j. 2 ) is greater than 1 — e. 

Proof: By similar analysis as in proof of Lemma [ 
Theorem 5.1: The probability of misdetection, (3, is: 



' 2O+™) 2(' l +™) 2 h ^ 

k=0 

where r = min{r 3 ^i, r 3 ^ 2 }. 
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Proof: The probability of misdetection is the minimum 
of the probability that vi and v-i do not detect a malicious V3. 
Therefore, by Lemma 15721 and 1531 the statement is true. ■ 

Theorem 15.11 shows that the probability of misdetection 
j3 decreases with the hash size, as the hashes restrict the 
space of consistent codewords. In addition, since 7*1^2, ?'2^i, 
r3_j.i, and r3_>2 represent the uncertainty introduced by the 
interference channels, /? increases with them. Lastly and the 
most interestingly, f3 decreases with n, since Y^k=o (&) < 2 n 
for r < n. This is because network coding randomizes the 
messages over a field whose size is increasing exponentially 
with n, and this makes it difficult for an adversary to introduce 
errors without introducing inconsistencies. 

We can apply Theorem 15.11 even when v\ and V2 can- 
not overhear each other. In this case, both n^.2 and r-2^i 
equal to n, giving the probability of misdetection, /3 = 

min{l,X)fe = o (fe)/ 8 ' 1 } where r = min{r 3 ^i,r 3 ^2}- Here, 
j3 highly depends on h, the size of the hash, as V\ and V2 are 
only using their own message and the overheard hashes. 

The algebraic approach results in an analysis with exact 
formulae for 7 and /3. In addition, these formulae are con- 
ditional probabilities; as a result, they hold regardless of a 
priori knowledge of whether V3 is malicious or not. However, 
performing algebraic analysis is not very extensible with 
growing to. 

VI. Algebraic Watchdog for Two-hop Network 

We extend the algebraic watchdog to a more general two- 
hop network, as in Figure [3] We shall develop upon the trellis 
introduced in Section [V] and formally present a graphical 
representation of the inference process performed by a node 
performing algebraic watchdog on its downstream neighbor. 

There are three main steps in performing the algebraic 
watchdog. First, we need to infer the original messages from 
the overheard information, which is captured by the transition 
matrix in Section [VI-AI The second step consists of forming 
an opinion regarding what the next-hop node v m +i should be 
sending, which is inferred using a trellis structure as shown 
in Section IVI-BI and a Viterbi-like algorithm in Section IVI-CI 
Finally, we combine the inferred information with what we 
overhear from i> m +i to make a decision on how u TO +i is 
behaving, as discussed in Section IVI-DI Figure [6] illustrates 
these three steps. 

A. Transition matrix 

We define a transition matrix Ti to be a 2 n( - 1 ~ H( -~^^ +s x 
2n(l-H{-^)) matrix where H(-) is the entropy function. 

HI*,,,) "«-»w 

1 0, otherwise 

ft(^,2/)=Pa (Xi,y) (l-Pa) n - A(il ' y) , 
■A/"= ^2 Pi(xi,y), 

{y\h(y)=h( Xi )} 

where A(x, y) gives the Hamming distance between code- 
words x and y. In other words, v\ computes Xi = {x\h(x) = 
h(xi)} to be the list of candidates of Xi. For any overheard 



pair [xi,h(xi)], there are multiple candidates of x, (i.e. \Xi\) 
although the probabilities associated with each inferred Xi are 
different. This is because there are uncertainties associated 
with the wireless medium, represented by BSC{pn). 

For each x G Xi, Pi(xi,x) gives the probability of x being 
the original codeword sent by node i>i given that V\ overheard 
Xi under BSC{pn). Since we are only considering x G Xi, 
we normalize the probabilities using TV to get the transition 
probability Ti(xi,x). Note Ti{xi,y) = if h(y) 7^ h{x{). 

The structure of Tj heavily depends on the collisions of 
the hash function h(-) in use. Note that the structure of Tj 
is independent of i, and therefore, a single transition matrix 
T can be precomputed for all i G [l,m] given the hash 
function h(-). A graphical representation of T is shown in 
Figure |6^. For simplicity of notation, we represent T as a 
matrix; however, the transition probabilities can be computed 
efficiently using hash collision lists as well. 

B. Watchdog trellis 

Node v% uses the information gathered to generate a trellis, 
which is used to infer the valid linear combination that 
v m+ i should transmit to u m +2- As shown in Figure I6J5, the 
trellis has to layers: each layer may contain up to 2" states, 
each representing the inferred linear combination so far. For 
example, Layer i consist of all possible values of a j x j- 

The matrices Ti,i G [2, to], defines the connectivity of the 
trellis. Let s 1 and ,s 2 be states in Layer i — 1 and Layer i, 
respectively. Then, an edge (si,.?2) exists if and only if 

3 x such that s\ + otiX = S2, Ti{xi, x) ^ 0. 

We denote w e (-, •) to be the edge weight, where w e (si, S2) = 
Ti(xi,x) if edge (si,S2) exists, and zero otherwise. 

C. Viterbi-like algorithm 

We denote w(s,i) to be the weight of state s in Layer i. 
Node v\ selects a start state in Layer 1 corresponding to a\Xi, 
as shown in Figure |6] The weight of Layer 1 state is w(s, 1) = 
1 if s = ot\X\, zero otherwise. For the subsequent layers, 
multiple paths can lead to a given state, and the algorithm 
keeps the aggregate probability of reaching that state. To be 
more precise, w(s, i) is: 



w(s, i) 



E 

Vs'GLayer i— 1 



w(s' , i — 1) • w e (s , s). 



By definition, w(s, i) is equal to the total probability of 
s = Ylj=i a j x j gi ven the overheard information. Therefore, 
w(s, to) gives the probability that s is the valid linear com- 
bination that v m+ i should transmit to v m +2- It is important 
to note that w(s,m) is dependent on the channel statistics, 
as well as the overheard information. For some states s, 
w(s, m) = 0, which indicates that state s can not be a valid 
linear combination; only those states s with w(s, m) > are 
the inferred candidate linear combinations. 

The algorithm introduced above is a dynamic program, and 
is similar to the Viterbi algorithm. Therefore, tools developed 
for dynamic programming/Viterbi algorithm can be used to 
compute the probabilities efficiently. 



Overheard Inferred 
information information 
[Xi,h(Xi)] X; 



Layer 1 Layer 2 Layer 3 Layer m-1 Layer m 



Inferred Overheard 
information information 
x m+i [ x m+i>h(x ra+1 )] 




Start 
state 





(a) Transition matrix T^XpXj) 



(b) Trellis for Algebraic Watchdog 



(c) Inverse transition matrix T~'(x m+I , x m+1 ) 



Fig. 6: Graphical representation of the inference process at node v\. In the trellis, the transition probability from Layer i—1 
to Layer i is given by Ti(xi,Xi), which is shown in (a). 



D. Decision making 

Node vi computes the probability that the overheard i m +i 
and h(x m+1 ) are consistent with the inferred w(-, m) to make 
a decision regarding w„ l+1 's behavior. To do so, V\ constructs 
an inverse transition matrix T~\ which is a 2 n ( 1 "^r-) x 
2 n ( 1 ^—)+ s matrix whose elements are defined as follows: 



T 1 (y,x m+ i 




if h(y) = h(x m+ i) 
otherwise 

M = ^2 Pm+i(x m +i,y)- 

{y\h(y)=h(x m+ i)} 

Unlike T introduced in Section IVl-AI T _1 (x, x m +i) gives 
the probability of overhearing [x m+ i,h(x m +i)) given that 
x G {y\h(y) = h(x m +i)} is the original codeword sent by 
v m +i and the channel statistics. Note that T _1 is identical 
to T except for the normalizing factor M., A graphical 
representation of T _1 is shown in Figure [(J. 

In Figure [6J;, s\ and S3 are the inferred candidate linear 
combinations, i.e. w(s-y,m) 7^ and w(s2,m) 7^ 0; the 
end node indicates what node V\ has overheard from v m+ i. 
Note that although si is one of the inferred linear combina- 
tions, si is not connected to the end node. This is because 
h(si) ^ h(x m +i)- On the other hand, ft.(s 2 ) = h(x m+ i); as a 
result, S2 is connected to the end node although w(s2,m) = 0. 
We define an inferred linear combination s as matched if 
w(s,m) > and h(s) = h(x m +\). 

Node vi uses T _1 to compute the total probability p* of 
hearing [x m +i,h(x m +i)] given the inferred linear combina- 
tions by computing the following equation: 

P* = y^w(s,m) ■ T~ 1 (s,x m+1 ). 

Probability p* is the probability of overhearing x m+ i given 
the channel statistics; thus, measures the likelihood that v m+ i 
is consistent with the information gathered by v\. Node v\ can 
use p* to make a decision on v m+ i's behavior. For example, 
vi can use a threshold decision rule to decide whether v m +i is 
misbehaving or not: v\ claims that u m +i is malicious if p* < t 
where t is a threshold value determined by the given channel 
statistics; otherwise, vi claims u TO +i is well-behaving. 

Depending on the decision policy used, we can use the 
hypothesis testing framework to analyze the probability of 
false positive and false negative. Section [V] provides such 



analysis for the simple two-hop network with a simple decision 
policy - if the inferred linear combination and the message 
overheard from the next hop node is non-empty, we declare the 
node well-behaving. However, the main purpose of this paper 
is to propose a method in which we can compute p*, which 
can be used to establish trust within a network. We note that it 
would be worthwhile to look into specific decision policies and 
their performance (i.e. false positive/negative probabilities) as 
in ED. 

VII. Analysis for Two-hop Network 

We provide an analysis for the performance of algebraic 
watchdog for two-hop network. 

Theorem 7.1: Consider a two-hop network as shown in 
Figure [3] Consider Vj, j G Then, the number of 

matched codewords is: 

2 »[E M3 , ie[1 , m+11 (ff(p l3 )-ff(^))-i]-™^ 

Proof: Without loss of generality, we consider V\. The 
proof uses on concepts and techniques developed for list- 
decoding f22| . We first consider the overhearing of z^'s trans- 
mission, k G [2, m]. Node v\ overhears Xk from Vk- The noise 
introduced by the overhearing channel is characterized by 
BSC(pki)\ thus, £'[A(xk, Xk)] = npki - Now, we consider the 
number of codewords that are within B(xk,npki), the Ham- 
ming ball of radius npki centered at Xk is \B(xk,npki)\ = 
2"( ff O«)- ff (%)). Node ui overhears the hash h(x k ); thus, 
the number of codewords that v\ considers is reduced to 
2 n \ H (Pki)-H(— ))-<5_ Tj s ing this information, v\ computes the 
set of inferred linear combinations, i.e. s where w(s, m) > 0. 
Note that v\ knows precisely the values of x\. Therefore, the 
number of inferred linear combinations is upper bounded by: 



n 

fc£[2,m] 



(1) 



(2) 



Due to the finite field operations, these inferred linear combi- 
nations are randomly distributed over the space {0, l} n . 

Now, we consider the overheard information, x m +i from 
the downstream node v m+ i. By similar analysis as above, 
we can derive that there are 2" (ff(Pm+l l) - H( ^ ti)) -' 5 code- 
words in the hamming ball B(x m +i, np m +i,i) with hash 
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foreach node v do 

According to the schedule, transmit and receive data; 
if v decides to check its neighborhood then 
Listen to neighbors' transmissions; 
foreach downstream neighbor v' do 

Perform Two-hop Algebraic Watchdog on v'\ 

end 

end 

end 

Algorithm 1: Distributed algebraic watchdog at v. 



value h(x m +\). Thus, the probability that a randomly chosen 
codeword in the space of {0, 1}" is in B{x m +\, np m +i,i) l~l 
{x\h(x) = h(x m +i)} is give by 

2 n(H(p m+1 , 1 )-H(i^±))-S 



Then, the expected number of matched codewords is the 
product of Equations (O and (O. ■ 

If we assume that the hash is of length S — en, then the 
statement in Theorem 17.11 is equal to: 

2 n i 6 [i,m+i] fl (Py)-(E i? !i,e[i, m +i] H(^)+l+me)\ ^ ^ 

This highlights the tradeoff between the quality of overhearing 
channel and the redundancy (introduced by C;'s and the hash 
h). If enough redundancy is introduced, then Ci and h together 
form an error-correcting code for the overhearing channels; 
thus, allows exact decoding to a single matched codeword. 

The analysis also shows how adversarial errors can be inter- 
preted. Assume that u m +i wants to inject errors at rate p a dv 
Then, node v\, although has an overhearing BSC(p m +i t i), 
effectively experiences an error rate of p a d v + p m +i.i — 
Padv ■ Pro+i,i- Note that this does not change the set of 
the inferred linear combinations; but it affects x m +i- Thus, 
overall, adversarial errors affect the set of matched codewords 
and the distribution of p*. As we shall see in Section [IX] the 
difference in distribution of p* between a well-behaving relay 
and adversarial relay can be used to detect malicious behavior. 

VIII. Protocol for Algebraic Watchdog 

We use the two-hop algebraic watchdog from Section [VT] 
in a hop-by-hop manner to ensure a globally secure network. 
In Algorithm [U we present a distributed algorithm for nodes 
to secure the their local neighborhood. Each node v trans- 
mits/receives data as scheduled; however, node v randomly 
chooses to check its neighborhood, at which point node v 
listens to neighbors transmissions to perform the two-hop 
algebraic watchdog from Section [VTl 

Corollary 8.1: Consider v m+ i as shown in Figure [3] As- 
sume that the downstream node v m +2 is well-behaving, and 
thus, forces h Xm+1 = h(x m +i). Let pi be the packet received 
by v m+i from parent node Vi £ P{v). Then, if there exists at 
least one well-behaving parent vj £ P(v), u m +i cannot inject 
errors beyond the overhearing channel noise (p m +i j) without 
being detected. 



Section lVTll noted that presence of adversarial error (at a rate 
above the channel noise) can be detected by a change in dis- 
tribution of p*. Corollary 18.11 does not make any assumptions 
on whether packets pi's are valid or not. Instead, the claim 
states that v m +i transmits a valid packet given the packets p, 
it has received. 

Corollary 8.2: Node v can inject errors beyond the channel 
noise only if either of the two conditions are satisfied: 

1) All its parent nodes P(v) = {u\(u,v) £ Ei} are 
colluding Byzantine nodes; 

2) All its downstream nodes, i.e. receivers of the transmis- 
sion pi, are colluding Byzantine nodes. 

Remark: In Case 1), v is not responsible to any well- 
behaving nodes. Node v can transmit any packet without 
the risk of being detected by any well-behaving parent node. 
However, then, the min-cut to v is dominated by adversaries, 
and the information flow through v is completely compromised 
- regardless of whether v is malicious or not. 

In Case 2), v can generate any hash value since its down- 
stream nodes are colluding adversaries. Thus, it is not liable to 
transmit a consistent hash, which is necessary for v's parent 
nodes to monitor v's behavior. However, note that v is not 
responsible in delivering any data to a well-behaving node. 
Even if v were well-behaving, it cannot reach any well- 
behaving node without going through a malicious node in 
the next hop. Thus, the information flow through v is again 
completely compromised. 

Therefore, Corollary 18.21 shows that the algebraic watchdog 
can aid in ensuring correct delivery of data when the following 
assumption holds: for every intermediate node v in the path 
between source to destination, v has at least one well-behaving 
parent and at least one well-behaving child - i.e. there exists 
at least a path of well-behaving nodes. This is not a trivial 
result as we are not only considering a single-path network, 
but also multi-hop, multi-path network. 

IX. Simulations 

We present MATLAB simulation results that show the 
difference in distribution of p* between the well-behaving and 
adversarial relay. We consider a setup in Figure [3] We set all 
Pn, i £ [2, to] to be equal, and we denote this probability as 
Ps = Pn for all i. We denote p a d v to be the probability at 
which the adversary injects error; thus, the effective error that 
V\ observes from an adversarial relay is combined effect of 
p m +i,i and Padv The hash function h{x) = ax + b mod 2 s 
is randomly chosen over a, b £ ¥ s 2 . 

We set n = 10; thus, the coding field size is 2 10 . A typical 
packet can have a few hundreds to tens of thousand bits. 
Thus, a network coded packet with n = 10 could have a few 
tens to a few thousands of symbols over which to perform 
algebraic watchdog. It may be desirable to randomize which 
symbols a node performs algebraic watchdog on, or when to 
perform algebraic watchdog. This choice depends not only on 
the security requirement, but also on the computational and 
energy budget of the node. 

For each set of parameters, we randomly generate symbols 
from F 2 io (n = 10 bits) and run algebraic watchdog. For 
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each symbol, under a non-adversarial setting, we assume 
that only channel randomly injects bit errors to the symbol; 
under adversarial setting, both the channel and the adversary 
randomly inject bit errors to the symbol. For each set of 
parameters, we run the algebraic watchdog 1000 times. Thus, 
this is equivalent to running the algebraic watchdog on a 
moderately-sized packet (10,000 bits) or over several smaller 
packets, which are network coded using field size of F 2 io. 

For simplicity, nodes in the simulation do not use error- 
correcting codes; thus, di = for all i. This limits the power of 
the algebraic watchdog; thus, the results shown can be further 
improved by using error correcting codes d. 

We denote p* adv and p* e i ay as the value of p* when the relay 
is adversarial and is well-behaving, respectively. We denote 
var adv and var re i ay to be the variance of p* adv and p* relay . We 
shall show results that show the difference in distribution of 
Padv an d Prelay f rom v i ' s perspective. Note that this illustrates 
that only one good parent node, i.e. v\ in our simulations, i: 
sufficient to notice the difference in distribution of p* adv anc 
Prelay Thus, confirming our analysis in Section IVIIII Witl 
more parent nodes performing the check independently, w< 
can improve the probability of detection. 

Our simulation results coincide with our analysis and in 
tuition. Figure UJ shows that adversarial above the channe 
noise can be detected. First of all, for all values of p a dv > 
Padv < Prelay' thus, showing that adversarial errors can bi 
detected. Furthermore, the larger the adversarial error injectioi 
rate, the bigger the difference in the distributions of p* adv anc 
Prelay When adversarial error rate is small, then the effectivi 
error v\ sees in the packet can easily be construed as that 
of the channel noise, and thus, if appropriate channel error 
correcting code is used, can be corrected by the downstream 
node. As a result, the values/distributions of p* elay and p* dv 
are similar. However, as the adversarial error rate increases, 
there is a divergence between the two distributions. Note 
that the difference in the distributions of p* elay and p* adv 
is not only in the average value. The variance var re iay is 
relatively constant throughout (var re iay is approximately 0.18 
throughout). On the other hand, var adv generally decreases 
with increase in p adv . For small p adv , the variance var adv is 
approximately 0.18; while for large p adv , the variance var a dv 
is approximately 0.08. This trend intuitively shows that, with 
increase in p adv , not only do we detect that the adversarial 
relay more often (since the average value of p* adv decreases), 
but we are more confident of the decision. 

Figure [8] shows the affect of the size of the hash. With 
increase in redundancy (by using hash functions of length 5), 
v\ can detect malicious behavior better. This is true regardless 
of whether the relay is well-behaving or not. Node vi 's ability 
to judge its downstream node increases with S. Thus, p* adv 
for 5 is generally higher than that of 6' where 5 > 5', This 
holds for p* e i ay as well. However, for any fixed 6, node v\ 
can see a distinction between p* elay and p* adv as shown in 
Figure [8] A similar trend to that of Figure [7j can be seen 
for the distributions of p* adv and p* e i ay for each value of S. 
The interesting result is that even for 6 = 0, i.e. we include 
no redundancy or hash, node v\ is able to distinguish an 
adversarial relay from a well-behaving relay. 




0.05 0.1 0.15 0.2 

Pad, 

Fig. 7: The average value of p* with well-behaving relay 
(denoted p* e i ay ) and adversarial relay (denoted p* adv ) over 
1000 random iterations of algebraic watchdog. The error bars 
represent the variance, var re iay and var adv . We set m = 3, 
n = 10, 6 = 2, and p s = p m +i,i = 10%. We vary p adv , the 
adversary's error injection rate. 
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Fig. 8: The average value of p* with well-behaving relay 
(denoted p* e i ay ) and adversarial relay (denoted p* adv ) over 
1000 random iterations of algebraic watchdog. We vary the 
value of 6, the length of the hash function used, and p adv , the 
adversary's error injection rate. The error bars represent the 
variance, var re i ay and var adv . We set m = 3, n = 10, and 

Ps = Prn+1,1 = 10%. 

Results in Figure [9] confirms our intuition that the better 
Vi's ability to collect information from Uj's, mel, the better its 
detection ability. If node V\ is able to infer better or overhear Xi 
with little or no errors, the better its inference on what the relay 
node should be transmitting. Thus, as overhearing channel 
progressively worsens (p s increases), v%'s ability to detect 
malicious behavior deteriorates; thus, unable to distinguish 
between a malicious and a well-behaving relay. 

Finally, we note the effect of m, the number of nodes in 
the network, in Figure [10] Node vi's ability to check v m+ i is 
reduced with m. When m increases, the number of messages 
vi has to infer increases, which increases the uncertainty 
within the system. However, it is important to note that as 
m increases, there are more nodes v^s, i e that can 

independently perform checks on v m +i- This affect is not 
captured by the results shown in Figure [10] 

X. Conclusions and Future Work 

We proposed the algebraic watchdog, in which nodes can 
verify their neighbors probabilistically and police them locally 
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(a) Linear scale (b) Log scale 



Fig. 9: The average value of p* with well-behaving relay 
(denoted p* e i ay ) and adversarial relay (denoted p* adv ) over 
1000 random iterations of algebraic watchdog. We vary the 
value of p s = p m +i,i, the quality of overhearing channels. 
The error bars represent the variance, var re i ay and var a dv 
We set 7?i = 3, n = 10, and p a d v = 10%. 
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(a) Linear scale (b) Log scale 

Fig. 10: The average value of p* with well-behaving relay 
(denoted p* e i ay ) and adversarial relay (denoted p* adv ) over 
1000 random iterations of algebraic watchdog. We vary the 
value of m, the number of nodes using v m+ i as a relay. The 
error bars represent the variance, var re i ay and var a d v - We set 
m = 3, n = 10, and p s = p m +i,i = Padv = 10%. 

by the means of overheard messages in a coded network. Using 
the algebraic watchdog scheme, nodes can compute a proba- 
bility of consistency, p* , which can be used to detect malicious 
behavior. Once a node has been identified as malicious, these 
nodes can either be punished, eliminated, or excluded from the 
network by using reputation based schemes such as l9l ll23l . 

We first presented a graphical model and an analysis of the 
algebraic watchdog for two-hop networks. We then extended 
the algebraic watchdog to multi-hop, multi-source networks. 
We provided a trellis-like graphical model for the detection 
inference process, and an algorithm that may be used to 
compute the probability that a downstream node is consistent 
with the overheard information. We analytically showed how 
the size of the hash function, minimum distance of the error- 
correcting code used, as well as the quality of the overhearing 
channel can affect the probability of detection. Finally, we 
presented simulation results that support our analysis and 
intuition. 

Our ultimate goal is to design a network in which the 
participants check their neighborhood locally to enable a 
secure global network - i.e. a self-checking network. Possi- 
ble future work includes developing inference methods and 



approximation algorithms to decide efficiently aggregate local 
trust information to a global trust state. 
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